@unbrained/pm-web 2026.8.29 → 2026.9.1

package/public/sw.js

@@ -213,12 +213,32 @@ async function flushMutationQueue() {
     const mutations = read.mutations;
     if (mutations.length === 0)
         return;
+    let replayCsrfToken;
+    try {
+        const bootstrap = await fetch('/api/auth/me', {
+            method: 'GET',
+            credentials: 'include',
+            cache: 'no-store',
+        });
+        replayCsrfToken = bootstrap.headers.get('x-csrf-token');
+        if (!replayCsrfToken) {
+            console.warn('Cannot replay offline mutations without a CSRF bootstrap token');
+            return;
+        }
+    }
+    catch {
+        // The network failed during token bootstrap; preserve the entire queue.
+        return;
+    }
     let replayed = 0;
     for (const mut of mutations) {
         try {
             const opts = {
                 method: mut.method,
-                headers: { 'Content-Type': 'application/json' },
+                headers: {
+                    'Content-Type': 'application/json',
+                    'X-CSRF-Token': replayCsrfToken,
+                },
                 credentials: 'include',
             };
             if (mut.body !== null)